- Freeradius-Users - lists.freeradius.org

Re: Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

MS-CHAP-Use-NTLM-Auth = No
by Jamie Crawford 31 Aug '05

31 Aug '05

Hi, I'm trying to have a local user in my users file called "guest" password "guest". If the user is not "guest" forward on the user to domain authentication. I'm having trouble when authenticating "guest" when it comes to the mchap authentication, although I have the "MS-CHAP-Use-NTLM-Auth = No", it still runs the ntlm_auth command against my domain controllers, which I don't have a "guest" account, and I don't want a "guest" account on my dc's, so it automatically rejects because I dont have a "guest" account on my domain. If I comment out the ntlm_auth command in radiusd.conf, it works fine, but of course my domain authentication doesn't work now. Any help is appreciated!!! Thanks, jamie guest User-Password == "guest", MS-CHAP-Use-NTLM-Auth = No, Filter-Id =Filter-Id =enterasys:version=1:policy=guest_basic" DEFAULT Auth-Type = System Filter-Id = "enterasys:version=1:policy=faculty_staff", Fall-Through = 1 Redhat AS4 Freeradius 1.0.4 Supplicants XP SP1,SP2 PEAP NT4 DOMAINS Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

1 0

Multiple VSA pairs
by Peter Hicks 31 Aug '05

31 Aug '05

Hello I'm using FreeRADIUS with MySQL for accounting and authentication. >From a Cisco 2651XM router, I have multiple Cisco-AVPair attributes send in accounting packets: rad_recv: Accounting-Request packet from host 192.168.167.14:1646, id=186, length=201 Acct-Session-Id = "00009E13" Cisco-AVPair = "isakmp-group-id=cg-ectvpn" Framed-IP-Address = 172.16.33.119 Cisco-AVPair = "isakmp-initator-ip=82.104.97.16" User-Name = "pwh" Cisco-AVPair = "connect-progress=Auth Open" Acct-Authentic = RADIUS Acct-Status-Type = Start Cisco-NAS-Port = "FastEthernet0/1" NAS-Port = 1 NAS-IP-Address = 192.168.167.14 Acct-Delay-Time = 0 When trying to refer to these in a SQL INSERT statement for accounting (where if the AVPair is 'isakmp-initiator-ip', it gets stripped and the address inserted), the AVPairs overwrite each other. Is there a workaround for this, or is the behaviour of a Cisco IOS router 'broken' for sending the same attribute twice in the same packet? Best wishes, Peter.

2 1

hi
by shruti kukkar 31 Aug '05

31 Aug '05

Hi all I am new to the freeRadius and wish to study the code of the server. Please tell me abt the code structure so as to be able to study and understand the code properly. Thanks Shruti --------------------------------- Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE! http://in.mail.yahoo.com

3 3

Digest test
by Iandc Davies 31 Aug '05

31 Aug '05

All, I am using freeradiusd 1.0.4 on RedHat Linux 9 and have just run the digest test suggested in the doc area through radclient. As it stands, I receive a code 3 reply (Access-Reject). The instruction for the test tells me to do the following: 1. In the /etc/raddb/users file insert entry as below :- test Auth-Type := Digest, User-Password = "test" Reply-Message = "Hello, test with Digest" 2. Initiate radclient with a file called digest (i.e. radclient -f digest localhost auth testing123) User-Name = "test", Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7", Digest-Realm = "testrealm", Digest-Nonce = "1234abcd", Digest-Method = "INVITE", Digest-URI = "sip:5555551212@example.com", Digest-Algorithm = "MD5", Digest-User-Name = "test" The command line holds the shared secret as defined in clients.conf file. However for this test to work, I had to insert a User-Password = "xxxx" (where xxxx is the actual password), into the digest file. After this I get a code 2 reply (Access-Accept). A radiusd -X dump shows freerad trying to do a unix authentication via the rlm_unix module. I've tried to comment out any instances of unix authentication from the radiusd.conf file but with the same results. Is there a way to tell freerad not to check user-password ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

New checkItem from LDAP
by Joe H 31 Aug '05

31 Aug '05

I am trying to create a new checkItem using an attribute stored in LDAP. I would like radius to check ldap to see if the attribute exists for a user and if it does, not assign a radiusPoolName. I have a radiusSNSEnable attribute setup in ldap and in the dictionary files as a check item. I have done lots of testing and googling and I have not found a clean solution that works. Below is the entry from my users file: DEFAULT SNS-Enable != "1" USR-Framed_IP_Address_Pool_Name = "BLACKHOLE1", Idle-Timeout := "120", Fall-Through = Yes Correct me if I'm wrong but that should mean, if the SNS-Enable attribute does not equal 1, assign the USR-Framed_IP_Address_Pool_Name and Idle-Timeout. I have SNS-Enable as a checkItem mapped to radiusSNSEnable in the ldap.attrmap. Does anyone have a solution for this? Could it be a processing order problem that I'm seeing? Does it process the users file and then LDAP so it's not checking or assigning the variable properly? If I set radiusSNSEnable as a replyItem I see it in the radius reply so I know it's getting the value. Thanks in advance for anyone that can help.

2 4

Re: concurrent TTLS and PEAP usage
by Stefan.Neis＠t-online.de 31 Aug '05

31 Aug '05

Hi, > what you are saying is that I should do something like this: > > user_ttls EAP-Type != PEAP > > that however only prohibits the usage of PEAP for user_ttls while i > would like to only enable TTLS for this specific user (which is not > quite the same). Yes, however you said yourself, that you do _not_ want to only enable TTLS for this specific user since you also obviously need to enable the inner protocol used inside the tunnel... Maybe something like if EAP-TYPE isn't EAP-TTLS and FreeRadius-Proxied-To is not set for user_ttls,t then reject as a first rule and as a second rule something like if FreeRadius-Proxied-To is set and AuthType isn't PAP then reject. And similar rules for user_peap. Regards, Stefan

1 0

Different behaviour with LDAP
by Þórður Ívarsson 31 Aug '05

31 Aug '05

I am authorizing wireless network cards in "users file" with radius server (old cistron radius) and that is working fine entry like: 121212-232323 Auth-Type = Accept Only network card matching abov entry get access Now I am building new radius server with FreeRadius and users information and passwords are kept in Open-LDAP I have following entry in my "users file" DEFAULT Huntgroup-Name == "wireless", Service-Type == Framed-User, Autz-Type:=zldap-macaddr, Auth-Type := Accept Fall-Through = No and this is in "radiusd.conf" ldap ldap-macaddr { server = "localhost" identity = "cn=manager,dc=skrin,dc=local" password = kept_secret basedn = "ou=users,ou=internet,dc=skrin,dc=local" filter = "(&(macAddress=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=wireless))" base_filter = "(objectclass=radiusprofile)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # password_attribute = userPassword # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes } I have also different sections for different huntgroups of the LDAP entry in radiusd.conf for other services and they work fine. The behaviour of the radius server is like that - authorize the client/user (match against huntgroup and ldap attribute search) then authenticate the user (trying to log into ldap server with user/password), but I have Auth-Type= accept, that I understand is allowing everyone that matces the authorize section. This breaks, it allows everyone that matches huntgroup but fails authorize. Is this normal or not? Þórður Ívarsson Skrín ehf

1 0

Windows Client Authentification bevore Domain logon
by Jérémy Cluzel 31 Aug '05

31 Aug '05

How can I add this OID to my machine certs ? using CA.certs script and xpextensions file ? Regards, Jeremy Ben Walding <ben.walding at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >/ /I also found using machine certificates to be hit and miss (some >/ /machines they'd be picked up, others they wouldn't - all XP SP2 with >/ /appropriate patches). >/ / >/ /And then I stumbled on this > / />/ ///http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html >/ / >/ /1.3.6.1.4.1.311.17.2 >/ / >/ /After I started adding that OID to my machine certs, everything >/ /started working wonderfully. >/ / >/ /I shook my fist at Microsoft that day! >/ / >/ /Cheers, >/ / >/ /Ben >/ /

1 0

urgent:problem with shared secret
by Geraldin Arthy 31 Aug '05

31 Aug '05

Hello, I am using free radius server for sending accounting request packets and receive accounting response packets.However it displays shared secret is incorrect.Could you let me know how to configured the free radius server for radius accounting or any special configuration has to be done apart from the naslist file and clients.conf file. Please let me know as soon as possible. --------------------------------- Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather

1 0